karellacortes@gmail.com

[firefly]

Posted on behalf of the victim.

The victim met the scammer online. "She" claimed to be from Philippines, living in China - name used Karen Arella Cortes. During the correspondence, the relation become closer and "she" decided to visit the victim in his country. For doing that, "she" was using the services of a Chinese travel agency, dealing with everything needed for that trip.

The trip was set and the victim paid for the flight ticket, sending the money through Money Gram as the request of the travel agency. Shortly after, the victim was notified that "she" was caught before leaving China, having gold gem stones with her and that's against the law - the Customs Department notified the victim that "she" may end up in jail for two years, asking the victim to contact them and solve the problem.

Email address "she" was using: karellacortes@gmail.com

Additional characters used in scam:

X. Zhuo International Travels - xzintltravelscn@126.com

China Guangzhou Customs Department - customsdepartment@customsgz.com

KARMELITA VILLANUEVA

[firefly]

Emails:

From: Karen Arella Cortes <karellacortes@gmail.com>
Date: March 2, 2016

hey baby,
i am sorry i couldnt hear you when you called yesterday, i guess it had to do with the phone network, how are you doing? (...) i am happy soon we shall be tgoether and we shall start having real fun.
today i went to the travel company like i told you i would, i showed them my passport, they had a good look at it and they said it is on good condition and that they will be able to help me get visa with it and then they directed me to the hospital where i went and took the medical test to determine if i have any disease or infection that will stop me from traveling out of the country, the results will be out tomorrow so i will have to go back tomorrow to the hospital, get my medical result and take it to the travel company to show to them, but i am confident that i dont have any disease, the results should be fine.
i told the travel firm that i am going to visit you and you will be helping me go there so they said i should give you their contact information so you can contact them because they need some information from you, the travel agent that i met is Mr. Lu and their email is info@xzintltravelscn.com, baby please can you try to write them and ask them what information they need from you? they said as soon as they finish with you that they will begin my visa process once they confirm my medical status.
sorry i wasnt online when you sent me the message, i am sending you a recent photo baby, i too cant wait to be able to see and talk to you in person, quite better than sending messages on the computer or trying to talk on the phone, cant wait to be able to talk, kiss and touch you baby.
soon it will surely happen for us, take care baby and try not to work too hard.
hugs and kisses,
your Karen.

Picture received with the email:

Fake document used in scam:

[firefly]

The travel agency:

From: "X. Zhuo International Travels" <xzintltravelscn@126.com>
Date: March 3, 2016
Subject: welcome to X. Zhuo International Travels

Greetings Mr. xxx,

Thank you for contacting us about your friend who is traveling to the United States of America.

Your friend Miss Karen Arella Cortes just left our office after bringing us her medical examination results which shows that she has no medical issue to prevent her from traveling to the United States of America, yesterday she came to our office to discuss about how to help her secure American tourist visa and ticket.

We asked that you contact us because she told us that you would be assisting her in the process. We already have your full name, please can you state your contact address and also you direct telephone number for future reference and which airport nearest to you is most convenient for you to receive her so we can check for the cheapest ticket available? She will be able to get a 6 month United States of America B-2 tourist visa to visit you and it will take 10 to 15 working days after we receive her travel cost from you for her visa to be processed.

If you have further questions, please don’t hesitate to contact us.

Best regards,
Mr. Kun Lu,
Director,
X. Zhuo International Travel Service Co., Ltd.

[firefly]

From: "X. Zhuo International Travels" <xzintltravelscn@126.com>
Date: March 4, 2016
Subject: travel cost for Karen A. Cortes

Greetings Mr. xxx,

Thank you for choosing our services here at X. Zhuo International Travel Service Co., Ltd., we received your email with the requested information for us to start processing for your friend’s visa.

Our visa experts are professionals in securing travel visas for our clients and we are confident that we will be able to secure tourist visa to the United States of America for your friend, and we are sending you details about the cost of your friend’s trip to USA.

Attached to this message you shall find a breakdown of the cost of the requirements for securing your friend a B-2 tourist visa that is a two-way ticket from Baiyun International Airport (CAN) Guangzhou China to xxx, United States, and her medical travel insurance and visa fee, totaling $1,555.89 USD (one thousand five hundred and fifty five United States dollars, eighty nine cents only).

You are to make the payment using our cashier payment department account information and send to our office a copy of the payment slip as soon as you make the payment so that we will start the process immediately. Please use the information given on the invoice to forward the fee to our office through bank to bank transfer or by Western Union or MoneyGram.

Please note that for bank to bank transfer it will take our cashier department 4 to 7 working days for the payment to be received but if you choose either Western Union or MoneyGram, we will be able to receive the payment at once and our office will immediately start processing her visa and since it will be taking 2 weeks or 3 weeks for her visa to be out we are assuming her travel date to be the 6th of April 2016, but when her visa comes out you have the right to choose an earlier date if you want.

Kindly inform your friend to come to our office to submit her passport with us and also sign for her visa application form so that immediately we receive the payment from you our visa experts will immediately submit to the embassy your friend's tourist visa application and international passport so she can be issued her visa in earnest.

Thank you for your cooperation.

Best regards,
Mr. Lu.

[firefly]

From: "X. Zhuo International Travels" <xzintltravelscn@126.com>
Date: May 23, 2016
Subject: Itinerary

Greetings Mr. xxx,

Your friend will be leaving China tonight at 23:55 with Emirates Airlines to arrive xxx, at 08:40 local time on Thursday the 26th of May and her ticket number is 176-956188xxxx, for confirmation of her flight we will like you to call your local Emirates Airlines office or their office here in China with telephone number 0086-20-8510-3232, you can give them her name and ticket number to confirm her flight, after confirmation inform us by email or call directly on 0086-13266109177.

Please see her flight itinerary for full details of her trip; we will like you to also call your friend immediately to inform her and tell her to also call us so we can give her further directives, she has to be in our office at least 4 to 5 hours before the flight time so we can take her to the airport.

Thank you for your cooperation and if you have questions, please let us know.

Best regards,
Mr. Lu.

+862085103232
Number billable as geographic number
Country or destination China
City or exchange location Guangzhou, GD

+8613266109177
Number billable as mobile number
Country or destination China
Original network provider* China Unicom

[firefly]

The travel agency used in scam is using a fake site for convincing the victims they are real.

According to their site:

China, one of the largest tourist countries in the world, boasts breathtaking scenery, time-honored history and profound culture. X. ZHUO International Travel Service Co., Ltd, a reputed travel agency specialized in inbound China travel, offers various all-inclusive private China tours, which cover the most breathtaking scenic area like Guilin, ancient historical city like Beijing, glorious cultural city like Xian, featured minority-populated area like Yunnan and the terrific experience like Yangtze River cruise. Join the fantastic private tour of China and discover the gem of China!

Contact Us

X. ZHUO International Travel Service Co., Ltd.

Office Address:
Room 1503, Main Tower,
Guangdong International Building,
339 Huanshi Road East,
Yuexiu District,
Guangzhou,
510098
Tel: 0086-13266109177
Email: info@xzintltravelscn.com, xzintltravelscn@126.com

Instead of China, the site is active in Nigeria.

Details of the fake site:
Domain Name: XZINTLTRAVELSCN.COM
Registry Domain ID: 2003778836_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.upperlink.ng
Registrar URL: upperlink.ng
Updated Date: 2016-04-18T02:24:50Z
Creation Date: 2016-02-17T20:36:17Z
Registrar Registration Expiration Date: 2017-02-17T20:36:17Z
Registrar: Upperlink Limited

Registrant details:
Registrant Name: Alex Wei
Registrant Organization: Awei Investment ltd
Registrant Street: 12 olowo street
Registrant City: Apapa
Registrant State/Province:
Registrant Postal Code: 23401
Registrant Country: NG
Registrant Phone: +234.8093394901
Registrant Email: awei1964@gmail.com

This is what the fake site is looking like:

[firefly]

Email:

From: customsdepartment@customsgz.com
Date: May 24, 2016
Subject: Urgent ( CHINA GUANGZHOU CUSTOMS DEPARTMENT )

CHINA GUANGZHOU CUSTOMS DEPARTMENT

ATTENTION!

Mr xxx,
We are from the (China Guangzhou Customs Department) we wish to contact you on behalf of a lady called Karen Arella Cortes,Originally from Philippines,The said lady was found during our airport luggage search and check point at (Guangzhou international airport China),on her way checking into the flight to travel to USA to meet you,according to her statement and during the search our officers confirmed in her possession a (8.5kg) worth of gold precious stone,according to the Chinese Law which stated categorically that no individual irrespective of class or office,Should export nor transport such hard rock materials overseas without a legit certificate,thereby made it unlawful for her to be in possession,export or transport,such material to oversea and has violated the Chinese Law which prompted for her detained in our custody for more interrogations,and this offense in punishable by Chinese Law she is likely going for 2 years prison jail terms,so Mr xxx, do reply us as soon as possible for us to complete our investigations.

Sincerely officer Long,
China Guangzhou Customs Department

[firefly]

The so called China Guangzhou Customs Department is in fact in Ghana - using a fake site created only for having an email address looking legit.

Details of the fake site:

Domain Name: CUSTOMSGZ.COM
Registry Domain ID: 1853994071_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.name.com
Registrar URL: http://www.name.com
Updated Date: 2016-04-12T02:07:39Z
Creation Date: 2014-04-09T12:19:40Z
Registrar Registration Expiration Date: 2017-04-09T12:19:40Z
Registrar: Name.com, Inc.

Registrant Name: Dateline Y Gray
Registrant Organization: AfroINTEL IT Solutions
Registrant Street: PMB
Registrant City: Sunyani
Registrant State/Province: Brong Ahafo
Registrant Postal Code: NA
Registrant Country: GH
Registrant Phone: +233.0201707707
Registrant Email: info@afrointel.com

[firefly]

Fake site used by the same group: adventuretourtravellers.com - is a well-established Travel Management Company, equipped with

According to their site:

Adventure Tour Travellers is a leader in the Travel Management Industry geared towards providing high quality, enhanced services for travellers. We have the ability to administer a Company-wide travel policy with exceptional data management capability.

We operate bearing in mind combinations of low transaction cost with enhanced service level, effective technology solution to optimize objective performance and creative strategies to guide travellers to the point of mutual market share attainment.

Adventure Tour Travellers is a well-established Travel Management Company, equipped with modern facilities to meet the needs of the traveling public.

We have e-ticket issuing authority of all the airlines, meaning we can issue all their ticket on-line from our office and send same to our client's respective e-mails. This is as a result of our healthy capital base and no default record on the IATA Billing and Settlement Plan (BSP).

In addition to the travel and tours services, we have a unique package providing protocol services to executive clients at the Airport and transit facilities. We also design bespoke services to suit our senior executive clients etc.

Contact Us Through:

31/E Block A, #10 Rongjiang Rd.
Longhu District, Shantou Guangdong
China.


Contact Tel:

+86 136 8623 4049
+86 136 1276 5417

E-mails:

info@adventuretourtravellers.com
sales@adventuretourtravellers.com
inquiry@adventuretourtravellers.com

+8613686234049 / +8613612765417 - mobile number

Details of the fake site; the identity of the registrant is hidden under privacy protection:

Domain Name: ADVENTURETOURTRAVELLERS.COM
Registry Domain ID: 1993634460_DOMAIN_COM-VRSN
Updated Date: 2016-01-12T08:42:01Z
Creation Date: 2016-01-12T08:42:01Z
Registrar Registration Expiration Date: 2017-01-12T08:42:01Z
Registrar: Name.com, Inc.
Registrar IANA ID: 625
Name Server: NS2.AFROINTEL.COM

This is what the fake site is looking like:

[firefly]

asiainternationaltours.com - Asia International Tours

According to their site:

With over decades of travel experience, Asia International Tours is your best choice for the perfect holiday. We know that you place a lot of trust in the company you choose to handle your travel bookings. We take that trust very seriously. We recommend the best to ensure that your trip is unforgettable.

Asia International Tours, is a leading Travel Agent and Tour operator in China.

Our Company, is a Company providing Ticketing and Air Travel services on behalf of most Airlines operating to and from China, as well as offering exquisitely packaged Tours within and outside the Country.

What started as a small Travel and Tour Company setup, has evolved to become part of a global Travel Management Organisation.

Contact Person:

Ms. Qian Liang

Our Address:
13F Xian China Merchant Plaza No. 45 Dong Guan Zheng Jie, Xian - China

Telephone:
+86 132 6824 8167

E-mail:
info@asiainternationaltours.com
inquiry@asiainternationaltours.com

+8613268248167 - mobile number

"Over decades of travel experience" means November last year. Instead of China, the site registrant is in Ghana:

Domain Name: ASIAINTERNATIONALTOURS.COM
Registry Domain ID: 1883762485_DOMAIN_COM-VRSN
Updated Date: 2015-10-28T23:09:35Z
Creation Date: 2014-11-05T19:06:06Z
Registrar Registration Expiration Date: 2016-11-05T19:06:06Z
Registrar: Name.com, Inc.

Registrant Name: Dateline Y Gray
Registrant Organization: AfroINTEL IT Solutions
Registrant Street: PMB
Registrant City: Sunyani
Registrant State/Province: Brong Ahafo
Registrant Postal Code: NA
Registrant Country: GH
Registrant Phone: +233.0201707707
Registrant Email: info@afrointel.com

This is what the fake site is looking like: